Thomas Patzke 121e21960e Rule changes ...

* Replaced variables with usual path names
* Removed Temp directories due to many false positives
* Matching on Image field, CommandLines often contain these paths

2019-05-09 23:09:22 +02:00

..

builtin

Further improved Windows user creation rule

2019-04-21 23:54:18 +02:00

malware

Update win_mal_ursnif.yml

2019-04-14 11:51:13 -05:00

other

Converted to use the new process_creation data source

2019-03-09 20:57:59 +03:00

powershell

Added missing tags and some minor improvements

2019-03-05 23:25:49 +01:00

process_creation

Rule changes

2019-05-09 23:09:22 +02:00

sysmon

Merge pull request #309 from jmlynch/master

2019-04-17 23:59:27 +02:00